Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
90 detections
Filters
Last updated
All Time
Detection languages
35
23
11
9
4
Contributors
26
21
20
3
3
Categories
44
39
38
27
17
Platforms
50
44
40
30
19
Products / Services
23
18
16
14
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
3
3
3
3
IDS Classtypes
9
6
6
2
IDS Protocols
22
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects Tailscale (tailscaled) reaching out to cloud instance metadata endpoints or Kubernetes internal service APIs, which may indicate unauthorized access or abuse of app connectors.
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
Detects attempts by potentially malicious processes, such as web-browsing tools, scripts, or agents, to access the cloud instance metadata service (169.254.169.254) or associated metadata paths. This behavior is indicative of Server-Side Request Forgery (SSRF) exploitation aimed at stealing cloud instance credentials.
Detects unauthorized processes attempting to access the cloud instance metadata service (169.254.169.254). Adversaries frequently target this endpoint to extract sensitive instance information, such as IAM credentials or configuration data, typically as part of post-exploitation discovery or SSRF-based attacks.
This rule detects inbound HTTP requests targeting Oracle PeopleSoft applications that contain malicious patterns indicative of Server-Side Request Forgery (SSRF) attempts. The rule inspects the URI for specific PeopleSoft application paths and suspicious redirection or internal IP address patterns (including internal cloud metadata addresses like 169.254.169.254) which are commonly used in SSRF attacks to probe or access internal resources.
Detects processes spawned by Terraform or Go (e.g., during init, apply, or run) that exhibit suspicious access to local cloud credential files (AWS/Azure/GCP) or Terraform state files. This behavior is indicative of a malicious module attempting to exfiltrate cloud credentials from a developer's workstation or a CI/CD build host.
Detects Node.js processes making outbound network connections to the AWS Instance Metadata Service (IMDS) IP address 169.254.169.254, which may indicate unauthorized data collection or discovery via server-side request forgery (SSRF).
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
KQL Query from file: cve-2026-19516-ssrf-exploitation-attempt-against-mcp-grafana-100.kql
Page 1 of 5